CyberSecBulletin
CVE-2026-64420NVD status: Modified

Linux: NULL Pointer Dereference

Published Updated By the CyberSecBulletin desk

CVE-2026-64420 is a high-severity NULL pointer dereference vulnerability in Linux, with a CVSS 3.1 base score of 7.0 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 24522713034d521ea4b5f5f36342e2b2f7e73bd6, f7e81dc181d9fe8ab977158042cd193e8cc12091, 257203d83204b192d1265a916b42ca0d499bb117 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.12% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 24522713034d521ea4b5f5f36342e2b2f7e73bd6 or f7e81dc181d9fe8ab977158042cd193e8cc12091 or 257203d83204b192d1265a916b42ca0d499bb117 or 729ae27dc2503a7c1f92da1859efb45da03e4fa0, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.261 or 5.15.212 or 6.1.178 or 6.6.145, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b up to, but not including, 24522713034d521ea4b5f5f36342e2b2f7e73bd6; 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b up to, but not including, f7e81dc181d9fe8ab977158042cd193e8cc12091; 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b up to, but not including, 257203d83204b192d1265a916b42ca0d499bb117; 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b up to, but not including, 729ae27dc2503a7c1f92da1859efb45da03e4fa0; 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b up to, but not including, ed2941e5db016a0c600b25f1972620e6e223d9fa; 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b up to, but not including, b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d; 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b up to, but not including, fc030c5b116f668d4ca86dca63742ddbc98d1665; 1c1d152cc5ac3a67d199728a9ba0b4f54a498f8b up to, but not including, 8b2c1d41bc36c100b38ce5ee6def246c527eaf8a; and 1 more ranges24522713034d521ea4b5f5f36342e2b2f7e73bd6, f7e81dc181d9fe8ab977158042cd193e8cc12091, 257203d83204b192d1265a916b42ca0d499bb117, 729ae27dc2503a7c1f92da1859efb45da03e4fa0, ed2941e5db016a0c600b25f1972620e6e223d9fa, b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d
LinuxLinux Kernel4.12 up to, but not including, 5.10.261; 5.11 up to, but not including, 5.15.212; 5.16 up to, but not including, 6.1.178; 6.2 up to, but not including, 6.6.145; 6.7 up to, but not including, 6.12.96; 6.13 up to, but not including, 6.18.39; 6.19 up to, but not including, 7.1.45.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
HighSuccess depends on conditions outside the attacker's control.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: mfd: cros_ec: Delay dev_set_drvdata() until probe success If ec_device_probe() fails, cros_ec_class_release releases memory for the cros_ec_dev structure. However, because the drvdata was already set, sub-drivers like cros_ec_typec can still retrieve the stale pointer via the platform device. This leads to a use-after-free when cros_ec_typec attempts to access &typec->ec->ec->dev on a device that has already been released. Move dev_set_drvdata() to ensure that the pointer is only made available once all initialization steps have succeeded. sysfs: cannot create duplicate filename '/class/chromeos/cros_ec' Call trace: sysfs_do_create_link_sd+0x94/0xdc sysfs_create_link+0x30/0x44 device_add_class_symlinks+0x90/0x13c device_add+0xf0/0x50c ec_device_probe+0x150/0x4f0 platform_probe+0xa0/0xe0 ... BUG: KASAN: invalid-access in __memcpy+0x44/0x230 Write at addr f5ffff809e2d33ac by task kworker/u32:5/125 Pointer tag: [f5], memory tag: [fe] Tainted : [W]=WARN, [O]=OOT_MODULE Hardware name: Google Navi unprovisioned 0x7FFFFFFF/sku0 board/sku3 Workqueue: events_unbound deferred_probe_work_func Call trace: __memcpy+0x44/0x230 cros_ec_check_features+0x60/0xcc [cros_ec_proto] cros_typec_probe+0xe8/0x6e0 [cros_ec_typec] platform_probe+0xa0/0xe0

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

How developers prevent this class of flaw

  • For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.
  • Select a programming language that is not susceptible to these issues.
  • Check the results of all functions that return a value and verify that the value is non-null before acting upon it.

More NULL Pointer Dereference vulnerabilities (CWE-476)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent NULL Pointer Dereference vulnerabilities

Spotted an error? Tell us.